Information Commissioner’s Office 


Consultation: Age appropriate design code 


Introduction 


The Information Commissioner is seeking feedback on her draft code of practice Age appropriate 
design: a code of practice for online services likely to be accessed by children (the code). 


The code will provide guidance on the design standards that the Commissioner will expect 
providers of online ‘Information Society Services’ (ISS), which process personal data and are likely 
to be accessed by children, to meet. 


The code is now out for public consultation and will remain open until 31 May 2019. The 
Information Commissioner welcomes feedback on the specific questions set out below. 


For this consultation, we will publish all resoonses except for those where the respondent indicates 
that they are an individual acting in a private capacity (e.g. a member of the public or a parent). All 
responses from organisations and individuals responding in a professional capacity (e.g. 
academics, child development experts, sole traders, child minders, education professionals) will be 
published. We will remove email addresses and telephone numbers from these responses but 
apart from this, we will publish them in full. 


For more information about what we do with personal data please see our privacy notice. 


Please note, we are using the platform Snap Surveys to gather this information. Any data collected 
by Snap Surveys for ICO is stored on UK servers. You can read their Privacy Policy here. 


Section 1: Your views on the code 


Is the 'About this code' section clearly communicated? 
Q1 © Yes 
No 


If no, then please provide your reasons for this view. 
Qla 


Is the 'Services covered by this code' section clearly communicated? 
Q2 @ Yes 
No 


If no, then please provide your reasons for this view. 
Q2a 


Section 2: Your views on the draft standards 


There are 16 draft standards in the code. You can comment on all the drafts 
standards, or focus on a single standard. If you do not want to answer questions on a 
standard please press skip. 


The standards are: 


1) Best interests of the child 

2) Age Appropriate Application 

3) Transparency 

4) Detrimental use of data 

5) Policies and community standards 
6) Default settings 

7) Data minimisation 

8) Data sharing 

9) Geolocation 

10) Parental Controls 

11) Profiling 

12) Nudge techniques 

13) Connected toys and devices 

14) Online tools 

15) Data protection impact assessments 
16) Governance and accountability 


Best interests of the child: The best interests of the child should be a primary 
consideration when you design and develop online services likely to be accessed 
by a child. 
Q3 © I would like to comment on this standard 
Skip 


Have we communicated our expectations for this standard clearly? 
Q4 © Yes 
No 
If no, then please give reasons for your answer. 
Q4a 


Do you have any examples that you think could be used to illustrate the 
approach we are advocating to this standard? 


Q5 Yes 


© No 


If yes, then please give reasons for your answer. 


Q5a 


Q6 


Q6a 


Q7 


Q7a 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


© Yes 


No 
If yes, then please give reasons for your answer. 


"The best interests of the child should be a primary consideration when you design and 
develop online services likely to be accessed by a child." There are lots of websites, such as 
news and media websites, who would have to consider making substantial changes to their 
editorial output if they have have the interests of children as a primary concern, just because 
children may access these sites, even if they are not the intended audience. 


Do you envisage any feasibility challenges to online services delivering this 
standard? 


© Yes 


No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


News and media websites could become tailored to an untargeted under 18s audience, rather than a 
grown-up adult audience simply because they are likely to be accessed by children and by having to 
consider the needs of children who may or may not be accessing their content, when they are not even an 


intended audience. These guidelines should be primarily focused on websites that are aimed at children, 
not capturing the entire output of the internet. 


Q8 


Q8a 


Q9 


Q9a 


Q10 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 


© Yes 
No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


The entire output of the digital creative industry would need to be reviewed and 


changed if these guidelines would be implemented, this would take much longer than 
three months. 


Do you know of any online resources that you think could be usefully linked to 
from this section of the code? 


Yes 


© No 


If yes, then please provide details (including links). 


Age-appropriate application: Consider the age range of your audience and 
the needs of children of different ages. Apply the standards in this code to all 
users, unless you have robust age-verification mechanisms to distinguish adults 
from children. 


© I would like to comment on this standard 


Skip 


Have we communicated our expectations for this standard clearly? 


Q11 @ Yes 
No 
If no, then please give reasons for your answer. 
Qila 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Q12 Yes 


© No 


If yes, then please give reasons for your answer. 
Q12a 


Q13 


Qi3a 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


© Yes 
No 
If yes, then please give reasons for your answer. 


The code suggests that all ISS service providers whose sites are “likely to be 
accessed by children” must provide a child-appropriate service to all users by default, 
with the option for adults to opt-out of this if they can verify their age (p.24). The 
requirements set out in the code on profiling and data sharing (see below), mean that 
it will either not be technically possible, or commercially viable, for many 
organisations to do this. The code notes that organisations must apply the standards 
to all users, unless there are robust age verification measures in place, and that self- 
declaration of age will not be sufficient for this purpose. The code itself notes that 
there are limited services currently available to assist with this. Organisations will, as 
a result, need to collect large amounts of additional, often highly sensitive, 
information, such as official identity documents solely for the purpose of meeting ICO 
guidance. The code notes, briefly and in passing, that organisations maintain a 
responsibility for security and privacy by design. It is not clear that the risks which 
the code seeks to mitigate need to be addressed by such an extensive processing of 
high risk documentation: there could still be a place for self-declared age verification, 
particularly for ISS less likely to attract children or where such services otherwise 
pose a low risk. It is inappropriate for the ICO to be promulgating a code which poses 
a security (and privacy by design) risk, which could be avoided by a more carefully 
considered approach. 


Do you envisage any feasibility challenges to online services delivering this 
standard? 


Q14 @ Yes 
No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q14a Some services may be suitable for older children, but not for younger children - such 
as certain online games, social media platforms or even new sites - but that current 
approaches to age verification all depend either on providing documentation only 
available to those over 18 (credit card number) or on providing identity documents 
(passport) which not all children will have and which run the risk of excluding certain 


socioeconomic groups. The requirement to verify age, in this context, will be 
impossible to implement. 


Do you think this standard requires a transition period of any longer than 3 
months after the code comes into force? 


Q15 @ Yes 
No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Qi5a If any such prescriptive requirements will be imposed, a much longer implementation 


period that 3 months will be required to ensure that more substantial design changes 
can be met. 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Q16 Yes 


© No 


If yes, then please provide details (including links). 
Qi6a 


Transparency: The privacy information you provide to users, and other 
published terms, policies and community standards, must be concise, 
prominent and in clear language suited to the age of the child. Provide 
additional specific ‘bite-sized’ explanations about how you use personal data at 
the point that use is activated. 


© I would like to respond to this standard 
Skip 


Q17 


Have we communicated our expectations for this standard clearly? 
Q18 @ Yes 
No 
If no, then please give reasons for your answer. 
Q18a 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Q19 Yes 


© No 


If yes, then please give reasons for your answer. 
Q19a 


Q20 


Q20a 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


© Yes 
No 
If yes, then please give reasons for your answer. 


The code states that organisations should provide: - privacy information and terms 
of service in child friendly language - where these deliver legally necessary language, 
then supplements should be used « notices on a just in time basis - multiple 
versions of their notice which are suitable for each age group - and, giventhe 
requirement to allow upward and downward movement between ages, for varying 
educational levels - as described in the code - non-traditional media for all age 
groups including the oldest children, such as cartoons, diagrams, graphics and video 
to ensure content is child friendly. The inclusion of specific “suggestions” by age is 
prescriptive, especially by content producers who may feasibly attract children of 
multiple ages to their sites. These proposed standards do not acknowledge the 
difficulty in assessing what age group a particular user may fall into (for the reasons 
set out above on age-verification, there may be no good way to determine the age or 
educational level of a child). It is important to take a risk-based approach to creating 
multiple privacy resources when too wide a range might cause unnecessary 
confusion. There were also concerns over the potential time and cost both in creating 
relevant materials and making changes to user interfaces and functionality of services 
so as to allow the information to be displayed in a manner set out in the code. If the 
ICO intends to retain specific suggestions by age group, it should take care to better 
acknowledge that these are not considered minimum expectations, and thought 
should be given on how ISS providers can be directed to meet the code’s 
requirements if multiple age groups may use the service. 


Do you envisage any feasibility challenges to online services delivering this standard? 
Q21 @ Yes 
No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q21a Separate privacy information for different age groups, for news and media websites 


where the audience is not intended to be children, but they may access it is 


unfeasible, as the sites would need to identify the age of the person to present the 
correct information. 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 


Q22 @ Yes 
No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q22a_ If any such prescriptive requirements will be imposed, a much longer implementation 


period that 3 months will be required to ensure that more substantial design changes 
can be met. 


Q23 


Q23a 


Q24 


Q25 


Q25a 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Yes 


© No 


If yes, then please provide details (including links). 


Detrimental use of data: Do not use children’s personal data in ways that 
have been shown to be detrimental to their wellbeing, or that go against 
industry codes of practice, other regulatory provisions or Government advice. 


I would like to respond to this standard 


© Skip 


Have we communicated our expectations for this standard clearly? 
Yes 
No 

If no, then please give reasons for your answer. 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Q26 Yes 


No 
If yes, then please give reasons for your answer. 
Q26a 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


Q27 Yes 
No 
If yes, then please give reasons for your answer. 
Q27a 


Do you envisage any feasibility challenges to online services delivering this standard? 


Q28 Yes 


No 
If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q28a 
Do you think this standard requires a transition period of any longer than 3 
months after the code comes into force? 

Q29 Yes 


No 
If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q29a 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Q30 Yes 
No 
If yes, then please provide details (including links). 
Q30a 


Policies and community standards: Uphold your own published terms, 
policies and community standards (including but not limited to privacy policies, 
age restriction, behaviour rules and content policies). 


I would like to respond to this standard 


© Skip 


Q31 


Have we communicated our expectations for this standard clearly? 
Q32 Yes 
No 


If no, then please give reasons for your answer. 
Q32a 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Q33 Yes 


No 
If yes, then please give reasons for your answer. 
Q33a 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


Q34 Yes 
No 
If yes, then please give reasons for your answer. 
Q34a 


Q35 


Q35a 


Q36 


Q36a 


Do you envisage any feasibility challenges to online services delivering this 
standard? 
Yes 


No 
If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 
Yes 


No 
If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Do you know of any online resources that you think could be usefully linked to 
from this section of the code? 


Q37 Yes 
No 
If yes, then please provide details (including links). 
Q37a 


Default settings: Settings must be ‘high privacy’ by default (unless you can 
demonstrate a compelling reason for a different default setting, taking account 
of the best interests of the child). 


Q38 I would like to respond to this standard 


© Skip 


Have we communicated our expectations for this standard clearly? 
Q39 Yes 
No 
If no, then please give reasons for your answer. 
Q39a 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Q40 Yes 


No 
If yes, then please give reasons for your answer. 
Q40a 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


Q41 Yes 
No 
If yes, then please give reasons for your answer. 
Q4ia 


Do you envisage any feasibility challenges to online services delivering this standard? 


Q42 Yes 


No 
If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q42a 
Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 

Q43 Yes 


No 
If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q43a 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Q44 Yes 
No 
If yes, then please provide details (including links). 
Q44a 


Data minimisation: Collect and retain only the minimum amount of personal 
data you need to provide the elements of your service in which a child is 
actively and knowingly engaged. Give children separate choices over which 
elements they wish to activate. 
© I would like to respond to this standard 

Skip 


Q45 


Have we communicated our expectations for this standard clearly? 
Q46 @ Yes 
No 


If no, then please give reasons for your answer. 
Q46a 


Q47 


Q47a 


Q48 


Q48a 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Yes 


© No 


If yes, then please give reasons for your answer. 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


© Yes 
No 
If yes, then please give reasons for your answer. 


This guidance contradicts the requirements for age verification, news and media 
websites that at the moment may only be collecting IP addresses and device IDs 
would need to be much more intrusive and require highly sensitive special categories 
of data just to verify the age of their audience. This carries any number of risks and 
unintended consequences. 


Do you envisage any feasibility challenges to online services delivering this standard? 
Q49 @ Yes 
No 
If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q49a_ it is not feasible to have guidance required websites to have a principle of data 
minimisation and then at the same time require them to collect data to robustly verify 
people's age. 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 


Q50 @ Yes 
No 
If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q50a Implementation of the standards set out in the code will require substantial 
operational, technical and design changes. Furthermore, it may require the 
engagement of third parties. As a result, a transition period of three months will not 
be sufficient. 


Q51 


Q5la 


Q52 


Q53 


Q53a 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Yes 


© No 


If yes, then please provide details (including links). 


Data sharing: Do not disclose children’s data unless you can demonstrate a 
compelling reason to do so, taking account of the best interests of the child. 


© I would like to respond to this standard 
Skip 


Have we communicated our expectations for this standard clearly? 


© Yes 
No 
If no, then please give reasons for your answer. 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Q54 Yes 


© No 


If yes, then please give reasons for your answer. 
Q54a 


Q55 


Q55a 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


© Yes 
No 
If yes, then please give reasons for your answer. 


The code suggests that organisations can only share personal data if they can 
demonstrate a "compelling reason to do so, taking into account the best interests of 
the child". The code gives the example of safeguarding or preventing or detecting 
crimes against children as a compelling interest. This clearly sets a very high bar. 
This barrier to sharing data is not present in, or required by, the GDPR or the DPA 
2018, where the relevant consideration would largely be whether there is a lawful 
basis for the processing . The underlying assumption for this section of the code is 
that "sharing children's personal data with third parties... can expose children to 
additional risks beyond those inherent in your own processing". The fact that another 
organisation is undertaking processing does not inherently represent an increase in 
risk: indeed, another organisation may be better placed to carry out some 
processing, yet the code would preclude this, absent compelling reasons such as 
prevention and detection of crime. This current drafting would restrict their ability to 
use processors to perform services for them. In addition, for corporate groups, 
multiple entities in the group will work together, across legal entities, to support a 
particular online product or service. The code would seem to restrict this and require 
services to be restructured with duplication of effort and teams. The impact of the 
code here is disproportionate to the disruptive effect it will produce. If the intention of 
the code is to limit sharing between controllers only, this should be made clear. The 
code should also allow controllers to make their own assessments on the risk of data 
sharing, rather than dictating that all sharing is high risk unless for reasons focussed 
on a child’s welfare. The code also notes that "selling on children's personal data for 
commercial re-use" is unlikely to amount to a compelling reason. It is not clear what 
types of activities this is intended to cover. Potentially, the statement could apply to 
use of targeted advertising online, where information is shared with ad-tech 
companies, and hence to multiple online services where ad-revenue is a main (or 
sole) source of revenue for the service. Anyone providing online services designed for 
a "general audience" - i.e. the site is not designed for children, but it is likely that 
some children (especially teens) do access the site. This would be true for music 
sites, film sites, online games (other than games which are specifically for over 18s) 


Q56 


Q56a 


Do you envisage any feasibility challenges to online services delivering this standard? 


© Yes 
No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


The revenue from tailored ads is significantly higher than that from contextual ads. 
This restriction will have a direct impact on the revenues of these services and as a 
result, certain services may no longer be commercially viable. This could ultimately 
result in a reduction of the content available to individuals under the age of 18, as 
companies may decide to restrict access to such services to ensure that they can 
remain commercially viable. Such an effect has already been seen on some news 
sites outside the EU which now block EU users due to perceived complexity of GDPR 
& cookie-compliance. This could lead to a loss of access to information and culture, 
impacting on a child’s rights to receive information and increasing risks that children 
either seek out rogue ISS choosing to ignore the code, or that they become 
unprepared for the adult online world they would inevitably meet on turning 18. The 
ICO should consider a risk-led approach to age-verification and other obligations in 
the code to help avoid the potential that children’s access is simply switched off when 
such tools are used. The ICO should reconsider why it considers data sharing to pose 
a risk per-se. The section should then be redrafted so that it seeks to mitigate a 
clearly articulated & substantiated risk and does not impose restrictions which are 
disproportionate to the benefit to be achieved. 


Q57 


Q57a 


Q58 


Q58a 


Q59 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 


© Yes 
No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Implementation of the standards set out in the code will require substantial 


operational, technical and design changes. Furthermore, it may require the 


engagement of third parties. As a result, a transition period of three months will not 
be sufficient. 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Yes 


© No 


If yes, then please provide details (including links). 


Geolocation: Switch geolocation options off by default (unless you can 
demonstrate a compelling reason for geolocation, taking account of the best 
interests of the child), and provide an obvious sign for children when location 
tracking is active. Options which make a child's location visible to others must 
default back to off at the end of each session. 


I would like to respond to this standard 


© Skip 


Have we communicated our expectations for this standard clearly? 
Q60 Yes 
No 
If no, then please give reasons for your answer. 
Q60a 


Do you have any examples that you think could be used to illustrate the 
approach we are advocating to this standard? 


Q61 Yes 
No 
If yes, then please give reasons for your answer. 
Q6la 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


Q62 Yes 
No 
If yes, then please give reasons for your answer. 
Q62a 


Do you envisage any feasibility challenges to online services delivering this 
standard? 
Q63 Yes 
No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q63a 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 


Q64 Yes 


No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q64a 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Q65 Yes 
No 
If yes, then please provide details (including links). 
Q65a 


Parental controls: If you provide parental controls give the child age 
appropriate information about this. If your online service allows a parent or 
carer to monitor their child's online activity or track their location, provide an 
obvious sign to the child when they are being monitored. 


Q66 I would like to respond to this standard 


© Skip 


Have we communicated our expectations for this standard clearly? 
Q67 Yes 
No 
If no, then please give reasons for your answer. 
Q67a 


Do you have any examples that you think could be used to illustrate the 
approach we are advocating to this standard? 


Q68 Yes 
No 
If yes, then please give reasons for your answer. 
Q68a 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


Q69 Yes 
No 
If yes, then please give reasons for your answer. 
Q69a 


Do you envisage any feasibility challenges to online services delivering this standard? 
Q70 Yes 


No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q70a 


Do you think this standard requires a transition period of any longer than 3 
months after the code comes into force? 


Q71 Yes 
No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q71a 
Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 
Q72 Yes 
No 
If yes, then please provide details (including links). 
Q72a 


Profiling: Switch options which use profiling off by default (unless you can 
demonstrate a compelling reason for profiling, taking account of the best 
interests of the child). Only allow profiling if you have appropriate measures in 
place to protect the child from any harmful effects (in particular, being fed 
content that is detrimental to their health or wellbeing). 


Sg © I would like to respond to this standard 


Skip 


Have we communicated our expectations for this standard clearly? 
Q74 @ Yes 
No 
If no, then please give reasons for your answer. 
Q74a 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Q75 Yes 


© No 


If yes, then please give reasons for your answer. 
Q75a 


Q76 


Q76a 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


© Yes 
No 
If yes, then please give reasons for your answer. 


As the code notes on p.63, profiling can be used for a wide range of purposes. Those 
mentioned in the code of relevance lots of media owners include: suggesting content; 
frequency capping (of display of content or ads); and targeted advertising. The code 
states that profiling should, by default, be turned off unless there is a compelling 
reason. The examples given of compelling interest on p.64 are child protection and 
safeguarding. The code also suggests that separate options should be given for each 
use of profiling - presumably, separate options for each of the purposes above. 
Delivery of content which is based on a profile is an important part of many 
information society services offered by our media owners who primarily have adult 
audiences that children (mainly 13-18) may legitimately access such as news 
websites. In the case of gaming, information about the player's performance, scores, 
purchases and interests will be used to generate new levels of a game, or challenges 
or purchases which will enhance the player's experience. Companies may not be 
able to provide certain games without profiling and in others, producing a version 
without profiling would be at the expense of player satisfaction (and fairness, given 
that such personalisation can allow players to gain “for free” based on loyalty and 
engagement in place of real-world payment). In the case of film studios or music 
labels, information about content which a visitor to the site has found of interest may 
be used by the studio or label to suggest similar content - either on that site, or on 
other sites. Feedback from clients was that if general ads or content are served, then 
this may lead to content being promoted which is less suitable for the audience and 
some clients had experienced complaints arising out of this situation, for example 
films for an older audience being displayed instead of a targeted advert suitable for a 
child. In each of the above examples, it will be difficult for companies to show that 
there is a "compelling reason" for this type of personalisation, given the illustrations 
at p.64. This may result in information society services being restricted to over 18s in 
situations when they would not otherwise need to be so restricted, with the risks of 
limited access highlighted previously. Alternatively this could lead to children being 
presented with multiple requests to permit profiling: a consent to personalise content 
recommended in the service, another consent to personalise content shown on other 


Do you envisage any feasibility challenges to online services delivering this standard? 
Q77 @ Yes 
No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q77a_ As described above. 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 


Q78 © Yes 
No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q78a Implementation of the standards set out in the code will require substantial 
operational, technical and design changes. Furthermore, it may require the 


engagement of third parties. As a result, a transition period of three months will not 
be sufficient. 


Q79 


Q79a 


Q80 


Q81 


Q8ia 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Yes 


© No 


If yes, then please provide details (including links). 


Nudge techniques: Do not use nudge techniques to lead or encourage children 
to provide unnecessary personal data, weaken or turn off privacy protections, 
or extend use. 


I would like to respond to this standard 


© Skip 


Have we communicated our expectations for this standard clearly? 
Yes 
No 

If no, then please give reasons for your answer. 


Do you have any examples that you think could be used to illustrate the 
approach we are advocating to this standard? 


Q82 Yes 
No 
If yes, then please give reasons for your answer. 
Q82a 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


Q83 Yes 
No 


If yes, then please give reasons for your answer. 
Q83a 


Q84 


Q84a 


Q85 


Q85a 


Do you envisage any feasibility challenges to online services delivering this 
standard? 

Yes 

No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Do you think this standard requires a transition period of any longer than 3 
months after the code comes into force? 


Yes 


No 
If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Do you know of any online resources that you think could be usefully linked to 
from this section of the code? 


Q86 Yes 
No 


If yes, then please provide details (including links). 
Q86a 


Connected toys and devices: If you provide a connected toy or device ensure 
you include effective tools to enable compliance with this code 


Q87 I would like to respond to this standard 


© Skip 


Have we communicated our expectations for this standard clearly? 
Q88 Yes 
No 
If no, then please give reasons for your answer. 
Q88a 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Q89 Yes 


No 
If yes, then please give reasons for your answer. 
Q89a 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


Q90 Yes 
No 
If yes, then please give reasons for your answer. 
Q90a 


O91 


Q9la 


Q92 


Q92a 


Do you envisage any feasibility challenges to online services delivering this 
standard? 
Yes 


No 
If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 
Yes 


No 
If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Q93 Yes 
No 
If yes, then please provide details (including links). 
Q93a 


Online tools: Provide prominent and accessible tools to help children exercise 
their data protection rights and report concerns. 


Q94 I would like to respond to this standard 


© Skip 


Have we communicated our expectations for this standard clearly? 
Q95 Yes 
No 
If no, then please give reasons for your answer. 
Q95a 


Do you have any examples that you think could be used to illustrate the approach 
we are advocating to this standard? 
Q96 Yes 


No 
If yes, then please give reasons for your answer. 
Q96a 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 
Q97 Yes 


No 
If yes, then please give reasons for your answer. 
Q97a 


Do you envisage any feasibility challenges to online services delivering this standard? 
Q98 Yes 


No 
If yes, then please provide details of what you think the challenges are and how you think 
they could be overcome? 
Q98a 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 
Q99 Yes 


No 
If yes, then please provide your reasons for this view, and give an indication of what you 
think a reasonable transition period would be and why. 
Q99a 


Q100 


Q100a 


Q101 


Q102 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Yes 
No 
If yes, then please provide details (including links). 


Data protection impact assessments: Undertake a DPIA specifically to assess 
and mitigate risks to children who are likely to access your service, taking into 
account differing ages, capacities and development needs. Ensure that your 
DPIA builds in compliance with this code. 


I would like to respond to this standard 


© Skip 


Have we communicated our expectations for this standard clearly? 
Yes 
No 

If no, then please give reasons for your answer. 


Do you have any examples that you think could be used to illustrate the 
approach we are advocating to this standard? 


Q103 Yes 
No 
If yes, then please give reasons for your answer. 
Q103 
a 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


Q104 Yes 
No 
If yes, then please give reasons for your answer. 
Q104 
a 


Do you envisage any feasibility challenges to online services delivering this standard? 


Q105 Yes 


No 
If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q105 
a 
Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 
Q106 Yes 
No 
If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 
Q106 


a 


Q107 


Q107 


a 


Q108 


Q109 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Yes 
No 
If yes, then please provide details (including links). 


Governance and accountability: Ensure you have policies and procedures in 
place which demonstrate how you comply with data protection obligations, 
including data protection training for all staff involved in the design and 
development of online services likely to be accessed by children. Ensure that 
your policies, procedures and terms of service demonstrate compliance with the 
provisions of this code 


I would like to respond to this standard 


© Skip 


Have we communicated our expectations for this standard clearly? 
Yes 
No 

If no, then please give reasons for your answer. 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Q110 Yes 
No 
If yes, then please give reasons for your answer. 


Q110 
a 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


Qiii Yes 
No 
If yes, then please give reasons for your answer. 


Qii1 
a 


Do you envisage any feasibility challenges to online services delivering this standard? 


Q112 Yes 


No 
If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q112 
a 


Do you think this standard requires a transition period of any longer than 3 
months after the code comes into force? 
Q113 Yes 


No 
If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q113 
a 


Do you know of any online resources that you think could be usefully linked to 
from this section of the code? 


Q114 Yes 
No 
If yes, then please provide details (including links). 
Q114 
a 


Section 3: Your views on the code sections 


Is the 'Enforcement of this code’ section of the code clearly communicated? 
Q115 @ Yes 
No 
If no, then please provide your reasons for this view. 


Q115 
a 


Is the 'Glossary' section of the code clearly communicated? 
Q116 @ Yes 
No 
If no, then please provide your reasons for this view. 


Q116 
a 


Are there any key terms missing from the 'Glossary'? 
Q117 Yes 

© No 

If yes, then please provide your reasons for this view. 


Q117 
a 


Is the 'Annex A: Age and developmental stages' section of the code clearly 
communicated? 


Q118 @ Yes 
No 
If no, then please provide your reasons for this view. 
Q118 
a 


Is there any information that you think needs to be changed in the Annex A: 
Age and developmental stages' section of the code? 


Q119 Yes 

© No 

If yes, then please provide your reasons for this view. 
Q119 
a 


Do you know of any online resources that could be usefully linked to the 
'Annex A: Age and developmental stages' section of the code? 


Q120 Yes 

© No 

If yes, then please provide details (including links). 
Q120 
a 


Is the 'Annex B: Lawful basis for processing’ section of the code clearly 
communicated? 


Q121 © Yes 
No 
If no, then please provide your reasons for this view. 
Q121 
a 


Is the 'Annex C: Data Protection Impact Assessment' section of the code 
clearly communicated? 


Q122 @ Yes 
No 
If no, then please provide your reasons for this view. 
Q122 
a 


Do you think any issues raised by the code would benefit from further (post 
publication) work, research or innovation? 


Q123 Yes 

© No 

If yes, then please provide your reasons for this view. 
Q123 
a 


Section 4: About you 


Are you answering as: 
Q124 A body representing the views or interests of children 

A body representing the views or interests of parents 
A child development expert 
An academic 

© An individual acting in another professional capacity 
A provider of an ISS likely to be accessed by children 
A trade association representing ISS providers 


An individual acting in a private capacity (e.g. someone providing their views as a 
member of the public of the public or a parent)? 


An ICO employee 
Other 
Please specify: 


Q124 a Data Governance Practitioner for a large publishing company 
a 


Please specify: 


Q124 
b 


Please state your name or if you're answering on behalf of an organisation, 
your organisation's name. 


Q125 Condé Nast Britain 


Thank you for responding to this consultation 
We value your input. 


